Industry News: ESG5

The Target: Slick, an Indian based social media platform.

The Take: Exposure of 153,000 records of Personally Identifiable Information including: full names, mobile numbers, dates of birth, and profile pictures, and some belong to minors.  

The Vector: A misconfigured data server was left open and unsecured, meaning anyone with an internet connection and knowledge of the IP address could have viewed and downloaded the data. The domain name for the database was also at risk by being under an easy to guess subdomain of Slick’s main website.

Authentication controls are an important piece in an overall robust cybersecurity posture. Companies should be fully aware of how their data is secured and stored. Furthermore, this sensitive user data is perfect for constructing highly effecting spear-phishing campaigns. Regular monitoring of data storage process can help mitigate these kinds of breaches to protect a firm’s data.

Read more...